If there is no workspace, validateFileMask reports ok() as you would expect. The error status should be reserved for cases where the validation method is reasonably sure something is actually wrong.
However any logic driven off FormValidation would really have to look for warnings, too, since for example a blank required field is normally shown as a warning rather than an error under the expectation that the user is about to fill it in and just has not gotten there yet and showing a red mark on a freshly loaded form is impolite. Not sure if we can defer validation checks until after the field has gotten focus, or if we could introduce a status which is logically like ERROR yet is displayed in a more toned-down UI that merely indicates that a field is required, not that you did something wrong.
I like the idea of showing a dialog when Save (or Apply) is clicked, which shows a list of outstanding warnings and errors.
Not sure about API design. A special IOException subclass that could be caught by top-level doConfigSubmit and used to redisplay the form page? But then your edits would be lost, or at least all the edits following the error in terms of order of application.
Graying out Save (and Apply) while there are outstanding errors might sound reasonable, but I am afraid that there may be too many situations where a false positive error is displayed—e.g. configuring a native Maven job will complain if you have no Maven installations, yet you might have already added one in another tab, and there is no way to dismiss the message. Perhaps all such cases should be treated as bugs in the code rendering the form validation, i.e. should downgrade to warning?